Privacy Policy

1. Controller and scope

The Ukrainian sole proprietor operating Knock Knock Tattoo (knockknock.tattoo) is the controller for account, website and service-operation data. Contact hello@knockknock.tattoo for privacy matters. This notice explains how we process personal data under applicable privacy law, including the GDPR where it applies. For correspondence that you process on a studio's or client's behalf, you may be the controller and we act as your processor under applicable contractual instructions; you remain responsible for a lawful basis to contact recipients.

2. Data we collect

Account data includes name, artist handle, email, login identifiers, profile preferences, language, location, plan, consent choices and support requests. Portfolio data includes images or links you provide, Instagram and website references, styles, availability, signature and terms. Studio correspondence includes recipient contact details, message bodies, translations, dates, attachments where supported, reply status and CRM records. Trip and calendar data includes events and information you choose to synchronise.

When you choose to connect Gmail, another mailbox or Google Calendar, we process authorised connection credentials and only the email or calendar information needed for enabled features. Access depends on the permissions displayed by the provider. We do not access unconnected mailboxes or calendars. At present, connections and sending may be unavailable; demo correspondence is fictional. We also collect necessary security and technical data such as IP addresses, browser details, error logs and account activity.

Paddle handles payment details. We receive limited order data such as customer, subscription and transaction identifiers, billing email, plan, amount, currency and payment status. We never see or store full card numbers or card security codes. Do not put sensitive health information, private client information or unnecessary personal data in portfolios or messages.

3. Purposes and legal bases

We process account, profile, correspondence and integration data to perform our contract: provide access, personalise your agent, deliver authorised outreach, translations, CRM and calendar features, and provide support. Necessary security, fraud prevention, troubleshooting and service reliability rely on our legitimate interests, balanced against your rights. Billing, tax records and lawful requests are processed to meet legal obligations. Optional marketing, analytics and non-essential cookies rely on consent; you can withdraw it without affecting earlier lawful processing. We do not sell personal data or use private correspondence for advertising.

We do not make solely automated decisions producing legal or similarly significant effects about you. AI suggestions and translations are assistive and require your review. For recipient data, our instructions and your lawful outreach purpose determine the processing; we support objections and suppression rather than treating a public email address as consent.

4. Recipients and providers

Authorised portfolio and message content is shared with the studios you choose to contact. Our service providers may process necessary data under appropriate confidentiality and data-protection terms: Lovable Cloud infrastructure powered by Supabase for accounts, database and hosting; Google for integrations you authorise; and AI providers for generating or translating content when those features are enabled. AI requests should contain only information needed for that task. We do not permit training on connected Gmail data or its use for advertising; connected Google data is not used to develop general-purpose AI models. Google API data use must comply with the Google API Services User Data Policy, including Limited Use requirements.

Paddle.com is our payment and order provider and Merchant of Record. Paddle processes buyer and payment data to handle checkout, tax, fraud prevention, billing, receipts and refunds. Paddle acts as an independent controller for its reseller and legal obligations, and as a processor where its applicable agreement provides for that role; it is not simply our processor for every purpose. Its own privacy notice explains those activities. We may also disclose data when legally required or to protect rights, with appropriate safeguards. A material provider change will be reflected in this notice.

5. International transfers and security

Providers may process data outside your country, including outside the EEA, depending on their infrastructure and the enabled integration. Where GDPR applies, transfers require an applicable adequacy decision or appropriate safeguards such as European Commission Standard Contractual Clauses and necessary supplementary measures. Contact us for information about applicable transfer safeguards. We use access restrictions, owner-scoped data permissions, encrypted transport and other proportionate measures, but no system can guarantee absolute security. Notify us promptly of suspected unauthorised access.

6. Retention

We retain account, portfolio and workspace data while your account is active and needed to provide the service. After an account-deletion request, we aim to remove or anonymise this data within 30 days, except information needed for legal claims, fraud prevention or legal obligations. Operational backups may retain deleted data for up to 90 additional days and are not used for ordinary service access. Security logs are ordinarily retained for up to 90 days; support records for up to 24 months after resolution. Billing and statutory records are retained for the legally required period, which varies by obligation and jurisdiction; Paddle applies its own retention rules to its records.

Revoke a connection at any time in your Google or mailbox provider account or contact us. We stop further access and delete connection credentials when disconnected. Relevant correspondence already stored in your workspace follows the workspace retention rules; copies delivered to studios are controlled by those recipients. We may retain minimal suppression information to ensure an objection is honoured.

7. Your rights

Where applicable, you can request access to your data, correction, deletion, restriction, portability, and object to processing based on legitimate interests, including direct marketing. You can withdraw consent at any time and revoke Google permissions through your Google account. Email hello@knockknock.tattoo; we may ask for proportionate information to verify identity. We normally respond within one month, with lawful extensions where necessary. Some records cannot be deleted while legal retention duties apply. You may complain to the relevant supervisory authority, including the authority in your EEA place of residence or work, without first contacting us.

8. Cookies, children and updates

Essential cookies or browser storage support login, security and your consent choices. Optional analytics and advertising tools are loaded only after consent and can be declined or withdrawn. See our Cookie Policy for details. The service is intended for adults, not children under 18. Contact us if a child has supplied personal data. We may update this notice as the service evolves; material changes will be announced within the service or by email. The effective date above identifies this version. Privacy questions: hello@knockknock.tattoo.